FreeIPA-users February 2020

freeipa-users@lists.fedorahosted.org

64 participants
104 discussions

Looking for an update to "Setting up MediaWiki to run against FreeIPA"
by White, Daniel E. (GSFC-770.0)[NICS] 18 Feb '20

18 Feb '20

Please ? https://www.freeipa.org/page/Setting_up_MediaWiki_to_run_against_FreeIPA It would appear that this page is over 6 years old. The link for the Auth_remoteuser tar-ball does not exist. and the extension installation instructions are obsolete. ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290

2 3

Traffic from client to server through management's interface
by Daniel PC 18 Feb '20

18 Feb '20

I would like to know what do you think about using the management network (eth1) to enable the flow from clients to IPA servers? My company is concerned about using the production network interface (eth0) and is considering doing everything on the second interface. Is it worth it? Pros and cons? What does your experience say? Thank you

3 3

systemd-tmpfiles-setup.service and sssd
by Rob Brown 17 Feb '20

17 Feb '20

I ran into a perplexing problem recently: We have all of our users/groups stored in ipa, including some "service accounts" that we run services under. As we started migrating to CentOS 7 we came across the issue with some services configured to store their PID files in /run (or /var/run) which is tmpfs and the services would fail to start due to missing pid directories. We learned that we could create a conf in /usr/lib/tmpfiles.d that would create the necessary directories on startup. Well, it didn't work. It took us a while to figure out, but the issue is that the user/group ownership of the directory was set to a user that is looked up from IPA (via sssd) and was failing with: systemd-tmpfiles[2171]: [/usr/lib/tmpfiles.d/my-service.conf:1] Unknown group 'my_group'. systemd-tmpfiles-setup.service: main process exited, code=exited, status=1/FAILURE BUT it seems that because sssd.service relies on systemd-tmpfiles-setup.service, we have a race condition. sssd.service +271ms └─basic.target @976ms └─sockets.target @975ms └─rpcbind.socket @975ms └─sysinit.target @969ms └─systemd-update-utmp.service @963ms +5ms └─auditd.service @933ms +28ms --> └─systemd-tmpfiles-setup.service @903ms +29ms └─rhel-import-state.service @874ms +28ms └─local-fs.target @872ms └─run-user-20137.mount @20.363s └─local-fs-pre.target @680ms └─lvm2-monitor.service @260ms +418ms └─lvm2-lvmetad.service @306ms └─lvm2-lvmetad.socket @260ms └─-.slice At first, I thought it might be due to the order of nsswitch.conf, but I changed from: group: files sss to: group: sss files and that didn't seem to make a difference. Curiously: it is not complaining that it can't find the user, only the group. Once the system is up, I can log in and: getent group my_group just fine. So if sssd is waiting on systemd-tmpfiles, how on earth can we ever use tmpfiles.d with users/groups stored in IPA if sssd isn't "up" yet? I am not sure how to handle this... just wondering in anyone has come across this before and if there is a solution. Thanks

1 1

sss_ssh_authorizedkeys slow on IPA-server
by Winfried de Heiden 17 Feb '20

17 Feb '20

Hi all, For some reason, for a particular user, sss_ssh_authorizedkeys is extremely slow on the IPA-server: time /usr/bin/sss_ssh_authorizedkeys <username>~real 0m9.520suser 0m0.022ssys 0m0.018s It will return all the public keys, but is is slow, causing SSH-login delays using a ssh-keys. On another CentOS Stream (8.1) IPA-client, using the same IPA-server: time /usr/bin/sss_ssh_authorizedkeys <username>~real 0m0.020suser 0m0.005ssys 0m0.003s Some difference...Adding "certificate_verification = no_ocsp" to sssd.conf on the IPA-server will bring back performance, but sound like a poor workaround. Any idea what is happening here? Some more details:CentOS Linux release 8.1.1911 (Core) (stream)ipa-client-4.8.0-13.module_el8.1.0+265+e1e65be4.x86_64sssd-common-2.2.0-19.el8.x86_64 Winfried

4 10

freeipa monitoring / 389ds_exporter
by Jiri B 17 Feb '20

17 Feb '20

Hi all, I'd like to monitor couple of FreeIPA servers with prometheus. What to use to monitor FreeIPA via prometheus? Any tips? I only found 389ds_exporter but's there's an error when it tries to get replica agreements. Otherwise it seems to return valid metrics. ~~~ ... DEBU[0020] getting replication agreements ERRO[0020] Scrape failed, error is:1 error occurred: * LDAP Result Code 32 "No Such Object": ~~~ https://github.com/terrycain/389ds_exporter/issues/2 Jiri

1 0

Authentication indicators smartcard, ssh and sudo
by Leon Castellano 14 Feb '20

14 Feb '20

Hi everyone, I have a CentOS8 FreeIPA 4.8.0 test environment with a CentOS8 client. I'm enforcing smart card authentication on the client by setting the "authentication indicator" to "pkinit" with the command "ipa host-mod <client> --auth-ind=pkinit". This works fine to restrict SSH, GDM and Console logins to smart card only, however, if I SSH into the client and try to SUDO, it of course doesn't accept the password anymore, and since the card is not connected locally to the client, it doesn't prompt for the pin. Is there a way to enforce smart card to login, but still allow sudo to accept passwords? Or to allow sudo to use the ssh-agent auth? (ssh-agent is working fine forwarding auth for SSH connections) I tried: yum install -y pam_ssh_agent_auth /etc/sudoers: Defaults env_keep += "SSH_AUTH_SOCK" /etc/pam.d/sudo: auth sufficient pam_ssh_agent_auth.so But "sudo -i" still prompts for the password. Any suggestions would be appreciated.

3 12

Help in understanding multiple KVNO versions in keytab file
by Kevin Vasko 14 Feb '20

14 Feb '20

Hello, I’m trying to understand when/how the different KVNO versions in a file should or shouldn’t work. We have a Dell EMC Unity box that’s giving us fits on what it will accept for a keytab file with different KVNO versions. I’m not sure if I’m misunderstanding something, or there’s a bug somewhere. So to start… Create a host: ipa host-add emc-nas-server.example.com --ip-address 10.75.37.2 Create a service: ipa service-add NFS/emc-nas-server.example.com(a)EXAMPLE.COM Get a keytab file: ipa-getkeytab -s ipaserver.example.com -p nfs/emc-nas-server.example.com -k /tmp/emc-nas-server.keytab –P Check the keytab file: ktutil ktutil: read_kt /tmp/emc-nas-server.example.com.keytab ktutil: list slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 1 nfs/emc-nas-server.example.com(a)EXAMPLE.COM 2 1 nfs/emc-nas-server.example.com(a)EXAMPLE.COM I upload the keytab file to the Dell Unity box. I can then mount the NFS share no problem with Kerberos sec=krb5 Now where my question comes in, if I generate a new keytab file with ipa-getkeytab -s ipaserver.example.com -p nfs/emc-nas-server.example.com -k /tmp/emc-nas-server.keytab –P Check the keytab file: ktutil ktutil: read_kt /tmp/emc-nas-server.example.com.keytab ktutil: list slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 1 nfs/emc-nas-server.example.com(a)EXAMPLE.COM 2 1 nfs/emc-nas-server.example.com(a)EXAMPLE.COM 3 2 nfs/emc-nas-server.example.com(a)EXAMPLE.COM 4 2 nfs/emc-nas-server.example.com(a)EXAMPLE.COM So now this keytab file has version 1 and version 2 in the keytab file. If I upload this file to the Dell Unity box and try to mount the NFS share that’s being validated via Kerberos it fails to mount. I validated that my NFS client is now sending kvno 2 with tcpdump. Since the Unity box has the new keytab file with 2 versions, shouldn’t the Unity box be checking against all of the versions of the keytab file or at least the latest (KVNO 2) allowing the mount to work? It seems that the Unity box is only checking against 1 KVNO version and failing. Since it’s the same keytab file shouldn’t this work or am I misunderstanding something? Thanks, -Kevin

2 1

external cert sign request - how to sign?
by lejeczek 14 Feb '20

14 Feb '20

hi everyone, how, if possible at, to have IPA sing a cert sign request which is not part of IPA's domain/realm? many thanks, L.

4 4

Re: Python-ing into FreeIPA - hit a glitch
by White, Daniel E. (GSFC-770.0)[NICS] 13 Feb '20

13 Feb '20

That was it. Moving forward. Again, many thanks. I suspect FreeIPA/RH-IdM 4.7.x will not be released to CentOS/RHEL 7, right ? ______________________________________________________________________________________________ Daniel E. White daniel.e.white(a)nasa.gov<mailto:daniel.e.white@nasa.gov> NICS Linux Engineer NASA Goddard Space Flight Center 8800 Greenbelt Road Building 14, Room E175 Greenbelt, MD 20771 Office: (301) 286-6919 Mobile: (240) 513-5290 From: Alexander Bokovoy <abokovoy(a)redhat.com> Date: Thursday, February 13, 2020 at 14:14 To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> Cc: Rob Crittenden <rcritten(a)redhat.com>, Daniel White <daniel.e.white(a)nasa.gov> Subject: [EXTERNAL] Re: [Freeipa-users] Python-ing into FreeIPA - hit a glitch On to, 13 helmi 2020, White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users wrote: Alexander, I followed your instructions and ran into a problem. These commands went as described: $ ipa service-add api-requester/`hostname` $ ipa service-allow-retrieve-keytab api-requester/`hostname` --users=me $ ipa service-allow-create-keytab api-requester/`hostname` --users=me $ ipa-getkeytab -Y GSSAPI -k api-requester.keytab -p api-requester/`me` $ KRB5_CLIENT_KTNAME=./api-requester.keytab KRB5CCNAME=./api.ccache ipa console (Custom IPA interactive Python console) api: IPA API object pp: pretty printer api.Command.whoami() {'object': 'service', 'command': 'service_show/1', 'arguments': ('api-requester/some-host.example.com(a)EXAMPLE.COM<mailto:api-requester/some-host.example.com@EXAMPLE.COM>',)} HOWEVER, when I tried this: api.Command.service_show('api-requester/some-host.example.com(a)EXAMPLE.COM<mailto:api-requester/some-host.example.com@EXAMPLE.COM>') I got this error: Traceback (most recent call last): File "<console>", line 1, in <module> File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 450, in __call__ return self.__do_call(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 471, in __do_call params = self.convert(**params) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 672, in convert (k, self.params[k].convert(v)) for (k, v) in kw.items() File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 672, in <genexpr> (k, self.params[k].convert(v)) for (k, v) in kw.items() File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 852, in convert return convert(value) File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 839, in convert return self._convert_scalar(value) File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 2152, in _convert_scalar return super(Principal, self)._convert_scalar(value) File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 862, in _convert_scalar raise ConversionError(name=self.name, error=ugettext(self.type_error)) ConversionError: invalid 'krbcanonicalname': must be Kerberos principal The argument I used in the "service_show" is identical to the argument returned from the "whoami" command. What is even stranger, If I exit the console and try : api.Command.ipa service-show api-requester/some-host.example.com(a)EXAMPLE.COM<mailto:api-requester/some-host.example.com@EXAMPLE.COM> I get the expected response. I ran this on a CentOS 7 IPA client v4.6.5-11.el7.centos.3.x86_64 The server is RHEL 7, IPA/RH-IdM server v4.6.5-11.el7_7.3.x86_64 Any ideas ? Can you try u'api-requester/...' as an argument to service_show(..)? Python 3 treats strings as unicode by default, Python 2 needs u'...'. When you run ipa CLI commands, we do Unicode transformation ourselves, but inside Python console it is your duty. BTW, note that services as members of group will not work in FreeIPA before 4.7, so you need Fedora or RHEL 8. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

2 1

Python-ing into FreeIPA - hit a glitch
by White, Daniel E. (GSFC-770.0)[NICS] 13 Feb '20

13 Feb '20

Alexander, I followed your instructions and ran into a problem. These commands went as described: $ ipa service-add api-requester/`hostname` $ ipa service-allow-retrieve-keytab api-requester/`hostname` --users=me $ ipa service-allow-create-keytab api-requester/`hostname` --users=me $ ipa-getkeytab -Y GSSAPI -k api-requester.keytab -p api-requester/`me` $ KRB5_CLIENT_KTNAME=./api-requester.keytab KRB5CCNAME=./api.ccache ipa console (Custom IPA interactive Python console) api: IPA API object pp: pretty printer api.Command.whoami() {'object': 'service', 'command': 'service_show/1', 'arguments': ('api-requester/some-host.example.com(a)EXAMPLE.COM',)} HOWEVER, when I tried this: api.Command.service_show('api-requester/some-host.example.com(a)EXAMPLE.COM') I got this error: Traceback (most recent call last): File "<console>", line 1, in <module> File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 450, in __call__ return self.__do_call(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 471, in __do_call params = self.convert(**params) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 672, in convert (k, self.params[k].convert(v)) for (k, v) in kw.items() File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 672, in <genexpr> (k, self.params[k].convert(v)) for (k, v) in kw.items() File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 852, in convert return convert(value) File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 839, in convert return self._convert_scalar(value) File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 2152, in _convert_scalar return super(Principal, self)._convert_scalar(value) File "/usr/lib/python2.7/site-packages/ipalib/parameters.py", line 862, in _convert_scalar raise ConversionError(name=self.name, error=ugettext(self.type_error)) ConversionError: invalid 'krbcanonicalname': must be Kerberos principal The argument I used in the "service_show" is identical to the argument returned from the "whoami" command. What is even stranger, If I exit the console and try : api.Command.ipa service-show api-requester/some-host.example.com(a)EXAMPLE.COM I get the expected response. I ran this on a CentOS 7 IPA client v4.6.5-11.el7.centos.3.x86_64 The server is RHEL 7, IPA/RH-IdM server v4.6.5-11.el7_7.3.x86_64 Any ideas ?

2 1

← Newer
1
...
4
5
6
7
8
9
10
11
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2020